{"id":1825,"date":"2026-09-22T15:38:19","date_gmt":"2026-09-22T07:38:19","guid":{"rendered":"https:\/\/www.liujh168.com\/index.php\/2026\/09\/22\/20260922-004\/"},"modified":"2026-09-22T15:38:19","modified_gmt":"2026-09-22T07:38:19","slug":"20260922-004","status":"publish","type":"post","link":"https:\/\/www.liujh168.com\/index.php\/2026\/09\/22\/20260922-004\/","title":{"rendered":"Agent\u5b89\u5168\u4e09\u5c42\u9632\u5fa1"},"content":{"rendered":"

\u8ba9 Agent \u5b89\u5168\u6267\u884c\u4ee3\u7801\uff1a\u4ece AST \u767d\u540d\u5355\u5230 Human-in-the-loop \u7684\u4e09\u5c42\u9632\u5fa1<\/h1>\n
\n

\u4f5c\u8005\uff1aAgent Dev \u5b9e\u8df5\u7b14\u8bb0 | \u53d1\u5e03\u65e5\u671f\uff1a2026-09-21 | \u6807\u7b7e\uff1aAgent, \u5b89\u5168, AST, Human-in-the-loop, Tool Policy<\/p>\n

<\/p>\n<\/blockquote>\n

\n

\u5f15\u5b50<\/h2>\n

\u6211\u89c1\u8fc7\u6709\u4eba\u8dd1 Agent \u65f6\u8bf4\uff1a”\u6ca1\u4e8b\uff0c\u5927\u4e0d\u4e86\u628a run_terminal<\/code> \u5de5\u5177\u4ece tool_map \u91cc\u5220\u6389\u5c31\u5b89\u5168\u4e86\u3002”<\/p>\n

\u542c\u8d77\u6765\u5f88\u5408\u7406\u5bf9\u5427\uff1f\u5de5\u5177\u6ca1\u6ce8\u518c\uff0cLLM \u60f3\u8c03\u4e5f\u8c03\u4e0d\u5230\u3002<\/p>\n

\u4f46\u4f60\u6709\u6ca1\u6709\u60f3\u8fc7\uff0cLLM \u5230\u5e95\u4f1a\u751f\u6210\u4ec0\u4e48\uff1f<\/p>\n

\u6709\u4e00\u5929\u6211\u8ba9 qwen3.5-9b \u8dd1\u4e86\u4e00\u4e2a demo\uff0c\u7528\u6237\u8f93\u5165\u662f”\u5e2e\u6211\u6e05\u7406\u4e00\u4e0b\u9879\u76ee\u6839\u76ee\u5f55\u7684\u4e34\u65f6\u6587\u4ef6”\u3002\u6a21\u578b\u7b2c\u4e00\u6b21\u8c03 file_read<\/code> \u8bfb\u4e86\u6839\u76ee\u5f55\u5217\u8868\uff0c\u7b2c\u4e8c\u6b21\u8c03 run_terminal<\/code> \u65f6\u751f\u6210\u7684\u547d\u4ee4\u662f\uff1a<\/p>\n

\n
<\/span>Remove-Item<\/span> -Path<\/span> "_test_chart.png"<\/span>,<\/span>"*.tmp"<\/span>,<\/span>"*.log"<\/span> -Force<\/span> -ErrorAction<\/span> SilentlyContinue<\/span>\n<\/code><\/pre>\n<\/div>\n
\u770b\u8d77\u6765\u5f88\u5408\u7406\u5bf9\u4e0d\u5bf9\uff1f\u4f46\u5982\u679c\u7528\u6237\u8f93\u5165\u7684\u662f”\u5e2e\u6211\u6e05\u7406\u4e00\u4e0b\u7535\u8111\u4e0a\u4e0d\u9700\u8981\u7684\u6587\u4ef6”\uff0c\u6a21\u578b\u53ef\u80fd<\/strong>\u4f1a\u751f\u6210\uff1a<\/p>\n
\n
<\/span>Remove-Item<\/span> -Path<\/span> "C:\\Users\\*\\Documents\\*"<\/span> -Recurse<\/span> -Force<\/span>\n<\/code><\/pre>\n<\/div>\n
LLM \u4e0d\u662f\u6076\u610f\u7684\u3002\u4f46\u5b83\u4e5f\u4e0d\u662f\u5b89\u5168\u4e13\u5bb6\u3002\u5b83\u4e0d\u77e5\u9053 Remove-Item -Recurse -Force<\/code> \u4f1a\u5220\u4ec0\u4e48\uff0c\u5b83\u4e5f\u4e0d\u77e5\u9053 C:\\Users*\\Documents* \u91cc\u9762\u6709\u4ec0\u4e48\u3002\u5b83\u53ea\u662f\u5728\u6982\u7387\u4e0a\u751f\u6210\u4e86”\u6e05\u7406\u6587\u4ef6”\u8fd9\u53e5\u8bdd\u6700\u53ef\u80fd\u5bf9\u5e94\u7684\u547d\u4ee4\u3002<\/p>\n
\u6240\u4ee5\u5b89\u5168\u4e0d\u80fd\u9760”LLM \u4f1a\u81ea\u89c9”<\/strong>\u3002\u6211\u4eec\u9700\u8981\u7eb5\u6df1\u9632\u5fa1<\/strong>\u2014\u2014\u4ece\u786c\u5230\u8f6f\u3001\u4ece\u4ee3\u7801\u5230\u7528\u6237\uff0c\u5c42\u5c42\u515c\u4f4f\u3002<\/p>\n
\n
\u4e00\u3001\u4e09\u5c42\u9632\u5fa1\u67b6\u6784\u603b\u89c8<\/h2>\n
\u6211\u4eec\u7684\u5b89\u5168\u4f53\u7cfb\u5206\u4e09\u5c42\uff0c\u4ece\u5916\u5230\u5185\u3001\u4ece”\u4ee3\u7801\u6267\u884c\u4e0d\u5230”\u5230”\u8ba9 LLM \u81ea\u5df1\u5224\u65ad”\uff1a<\/p>\n
\n
<\/span>\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n\u2502 \u7b2c\u4e09\u5c42\uff1a\u8ba9 LLM \u81ea\u5df1\u5224\u65ad                                              \u2502\n\u2502 human_confirm \u5de5\u5177\uff08\u6ce8\u518c\u4e3a Function Calling \u5de5\u5177\uff09                   \u2502\n\u2502 \u2192 "\u654f\u611f\u64cd\u4f5c\u524d\u8bf7\u8c03\u8fd9\u4e2a\u5de5\u5177" \u2192 Agent \u53ef\u4ee5\u4e3b\u52a8\u6682\u505c\u7b49\u7528\u6237\u786e\u8ba4              \u2502\n\u2502                                                                     \u2502\n\u2502 \u2500 \u2500 \u2500 \u2500 \u2500 \u2500 \u2500 \u2500 \u2500 \u2500 \u2500 \u2500 \u2500 \u2500 \u2500 \u2500 \u2500 \u2500 \u2500 \u2500 \u2500 \u2500 \u2500 \u2500 \u2500 \u2500 \u2500 \u2500 \u2500 \u2500 \u2500  \u2502\n\u2502 \u7b2c\u4e8c\u5c42\uff1a\u8f6f\u62e6\u622a                                                       \u2502\n\u2502 ToolPolicy \u56db\u7ea7\u98ce\u9669\u5206\u7c7b + ToolExecutor                              \u2502\n\u2502 classify \u2192 \u5224\u5b9a \u2192 allow\/confirm \u2192 \u6267\u884c\/\u62e6\u622a                           \u2502\n\u2502                                                                     \u2502\n\u2502 \u2500 \u2500 \u2500 \u2500 \u2500 \u2500 \u2500 \u2500 \u2500 \u2500 \u2500 \u2500 \u2500 \u2500 \u2500 \u2500 \u2500 \u2500 \u2500 \u2500 \u2500 \u2500 \u2500 \u2500 \u2500 \u2500 \u2500 \u2500 \u2500 \u2500 \u2500  \u2502\n\u2502 \u7b2c\u4e00\u5c42\uff1a\u786c\u62e6\u622a                                                       \u2502\n\u2502 AST \u767d\u540d\u5355 + SQL mode=ro + PowerShell \u5173\u952e\u8bcd\u9ed1\u540d\u5355                    \u2502\n\u2502 \u2192 \u5728\u51fd\u6570\u5185\u90e8\uff0c\u5371\u9669\u8f93\u5165\u88ab\u62e6\u622a\uff0c\u6267\u884c\u4e0d\u5230 OS \u5c42                          \u2502\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n<\/code><\/pre>\n<\/div>\n
\n
\u4e8c\u3001\u7b2c\u4e00\u5c42\uff1a\u786c\u62e6\u622a \u2014 \u6839\u672c\u6267\u884c\u4e0d\u5230\u5371\u9669\u8def\u5f84<\/h2>\n
\u786c\u62e6\u622a\u662f”\u628a\u5371\u9669\u6321\u5728\u51fd\u6570\u95e8\u53e3”\u2014\u2014\u4e0d\u7ba1\u8c01\u8c03\u8fd9\u4e2a\u51fd\u6570\uff08LLM \u8c03\u7684\u3001\u6d4b\u8bd5\u4ee3\u7801\u8c03\u7684\u3001\u672a\u6765\u67d0\u4e2a\u65b0 Agent \u8c03\u7684\uff09\uff0c\u53ea\u8981\u8f93\u5165\u662f\u5371\u9669\u7684\uff0c\u51fd\u6570\u76f4\u63a5\u8fd4\u56de\u9519\u8bef\uff0c\u6c38\u8fdc\u6267\u884c\u4e0d\u5230\u771f\u6b63\u7684\u5371\u9669\u4ee3\u7801\u3002<\/p>\n
2.1 Calculator\uff1aAST \u767d\u540d\u5355<\/h3>\n
calculator<\/code> \u5de5\u5177\u7684\u95ee\u9898\u662f”\u8ba9 LLM \u5199\u4e00\u4e2a\u6570\u5b66\u8868\u8fbe\u5f0f\u7136\u540e eval \u5b83”\u3002\u4f46\u5982\u679c\u8868\u8fbe\u5f0f\u662f __import__('os').listdir()<\/code> \u5462\uff1feval<\/code> \u4f1a\u771f\u7684\u6267\u884c\u3002<\/p>\n
\u6211\u4eec\u7684\u89e3\u6cd5\u662f\u6839\u672c\u4e0d\u8ba9 eval<\/code> \u89c1\u5230\u4efb\u4f55\u975e\u6570\u5b66\u8282\u70b9<\/strong>\uff1a<\/p>\n
\n
<\/span># tools\/demo.py \u2014 \u7b80\u5316\u7248\uff08\u771f\u5b9e\u4ee3\u7801\u5728\u9879\u76ee\u91cc\uff09<\/span>\nimport<\/span> <\/span>ast<\/span>\n\n_ALLOWED_OPS<\/span> =<\/span> {<\/span>ast<\/span>.<\/span>Add<\/span>,<\/span> ast<\/span>.<\/span>Sub<\/span>,<\/span> ast<\/span>.<\/span>Mult<\/span>,<\/span> ast<\/span>.<\/span>Div<\/span>,<\/span> ast<\/span>.<\/span>Pow<\/span>,<\/span> ast<\/span>.<\/span>Mod<\/span>,<\/span> ast<\/span>.<\/span>USub<\/span>}<\/span>\n\ndef<\/span> <\/span>calculator<\/span>(<\/span>expression<\/span>:<\/span> str<\/span>)<\/span> -><\/span> str<\/span>:<\/span>\n    try<\/span>:<\/span>\n        tree<\/span> =<\/span> ast<\/span>.<\/span>parse<\/span>(<\/span>expression<\/span>,<\/span> mode<\/span>=<\/span>"eval"<\/span>)<\/span>\n        # \u9012\u5f52\u6821\u9a8c\u6bcf\u4e00\u4e2a\u8282\u70b9<\/span>\n        _safe_eval<\/span>(<\/span>tree<\/span>.<\/span>body<\/span>)<\/span>   # \u2190 \u5728\u8fd9\u91cc\u4f1a\u62d2\u7edd Call\/Name\/Attribute \u7b49<\/span>\n        return<\/span> "OK"<\/span>\n    except<\/span> Exception<\/span> as<\/span> exc<\/span>:<\/span>\n        return<\/span> f<\/span>"\u8ba1\u7b97\u5931\u8d25: <\/span>{<\/span>exc<\/span>}<\/span>"<\/span>\n\ndef<\/span> <\/span>_safe_eval<\/span>(<\/span>node<\/span>):<\/span>\n    if<\/span> isinstance<\/span>(<\/span>node<\/span>,<\/span> ast<\/span>.<\/span>BinOp<\/span>):<\/span>\n        if<\/span> type<\/span>(<\/span>node<\/span>.<\/span>op<\/span>)<\/span> not<\/span> in<\/span> _ALLOWED_OPS<\/span>:<\/span>\n            raise<\/span> ValueError<\/span>(<\/span>f<\/span>"\u4e0d\u652f\u6301\u7684\u8fd0\u7b97\u7b26: <\/span>{<\/span>type<\/span>(<\/span>node<\/span>.<\/span>op<\/span>)<\/span>.<\/span>__name__<\/span>}<\/span>"<\/span>)<\/span>\n        return<\/span> _safe_eval<\/span>(<\/span>node<\/span>.<\/span>left<\/span>),<\/span> _safe_eval<\/span>(<\/span>node<\/span>.<\/span>right<\/span>)<\/span>\n    if<\/span> isinstance<\/span>(<\/span>node<\/span>,<\/span> ast<\/span>.<\/span>Constant<\/span>)<\/span> and<\/span> isinstance<\/span>(<\/span>node<\/span>.<\/span>value<\/span>,<\/span> (<\/span>int<\/span>,<\/span> float<\/span>)):<\/span>\n        return<\/span> node<\/span>.<\/span>value<\/span>\n    # \u2191 \u53ea\u5141\u8bb8 BinOp\uff08\u56db\u5219\u8fd0\u7b97\uff09\u548c Constant\uff08\u6570\u5b57\u5e38\u91cf\uff09<\/span>\n    # Call \/ Name \/ Attribute \/ Subscript \/ Lambda \u2014 \u4e00\u5f8b\u62d2\u7edd<\/span>\n    raise<\/span> ValueError<\/span>(<\/span>f<\/span>"\u4e0d\u652f\u6301\u7684\u8868\u8fbe\u5f0f\u5143\u7d20: <\/span>{<\/span>type<\/span>(<\/span>node<\/span>)<\/span>.<\/span>__name__<\/span>}<\/span>"<\/span>)<\/span>\n<\/code><\/pre>\n<\/div>\n
eval(\"__import__('os').listdir()\")<\/code> \u7684 AST \u4f1a\u6709\u4e00\u4e2a Call<\/code> \u8282\u70b9 \u2192 _safe_eval<\/code> \u9047\u5230 Call<\/code> \u2192 \u76f4\u63a5 raise \u2192 \u9519\u8bef\u8fd4\u56de \u2192 LLM \u62ff\u4e0d\u5230\u6267\u884c\u673a\u4f1a<\/strong>\u3002<\/p>\n
2.2 SQL\uff1a\u6570\u636e\u5e93\u5c42\u7269\u7406\u53ea\u8bfb<\/h3>\n
\n
<\/span># tools\/sql.py \u2014 SQLite URI \u53c2\u6570 + PRAGMA \u53cc\u91cd\u53ea\u8bfb<\/span>\nuri<\/span> =<\/span> abs_path<\/span>.<\/span>as_uri<\/span>()<\/span> +<\/span> "?mode=ro"<\/span>    # \u2190 OS \u6587\u4ef6\u7ea7\u53ea\u8bfb\uff1a\u65e0\u6cd5\u5199\u6587\u4ef6<\/span>\nconn<\/span> =<\/span> sqlite3<\/span>.<\/span>connect<\/span>(<\/span>uri<\/span>,<\/span> uri<\/span>=<\/span>True<\/span>)<\/span>\nconn<\/span>.<\/span>execute<\/span>(<\/span>"PRAGMA query_only=ON"<\/span>)<\/span>   # \u2190 SQLite \u5f15\u64ce\u7ea7\u53ea\u8bfb\uff1a\u65e0\u6cd5\u6267\u884c\u5199\u64cd\u4f5c<\/span>\n<\/code><\/pre>\n<\/div>\n
\u4e24\u5c42\u4fdd\u62a4\uff1a
\n– URI mode=ro<\/code> \u8ba9 SQLite \u6839\u672c\u6253\u4e0d\u5f00\u6587\u4ef6\u7684\u5199\u5165\u53e5\u67c4 \u2192 OS \u5c42\u62d2\u7edd
\n– PRAGMA query_only=ON<\/code> \u8ba9 SQLite \u5f15\u64ce\u62d2\u7edd\u6240\u6709\u5199\u64cd\u4f5c \u2192 \u5f15\u64ce\u5c42\u62d2\u7edd<\/p>\n
DROP TABLE users<\/code> \u4f1a\u5728 SQL \u6267\u884c\u65f6\u88ab\u5f15\u64ce\u62d2\u7edd\uff0c\u6839\u672c\u4e0d\u4f1a\u771f\u6b63\u5220\u6570\u636e\u3002<\/p>\n
2.3 PowerShell \u5173\u952e\u8bcd\u9ed1\u540d\u5355<\/h3>\n
\n
<\/span># tools\/system.py \u2014 \u7b80\u5316\u7248<\/span>\n_DANGEROUS_CMD_PATTERNS<\/span> =<\/span> [<\/span>\n    "rm -rf \/"<\/span>,<\/span> "Remove-Item -Recurse -Force"<\/span>,<\/span>\n    "Stop-Computer"<\/span>,<\/span> "Restart-Computer"<\/span>,<\/span> "Format-Volume"<\/span>,<\/span>\n    "Set-Content"<\/span>,<\/span> "Invoke-WebRequest -OutFile"<\/span>,<\/span>\n    # ... \u7ea6 40 \u6761<\/span>\n]<\/span>\n\ndef<\/span> <\/span>run_terminal<\/span>(<\/span>command<\/span>:<\/span> str<\/span>)<\/span> -><\/span> str<\/span>:<\/span>\n    # \u786c\u62e6\u622a\u7b2c\u4e00\u6b65\uff1a\u5173\u952e\u8bcd\u5339\u914d<\/span>\n    for<\/span> pattern<\/span> in<\/span> _DANGEROUS_CMD_PATTERNS<\/span>:<\/span>\n        if<\/span> re<\/span>.<\/span>search<\/span>(<\/span>pattern<\/span>,<\/span> command<\/span>,<\/span> re<\/span>.<\/span>IGNORECASE<\/span>):<\/span>\n            return<\/span> f<\/span>"\u5b89\u5168\u62e6\u622a\uff1a\u547d\u4ee4\u5305\u542b\u5371\u9669\u5173\u952e\u8bcd '<\/span>{<\/span>pattern<\/span>}<\/span>'"<\/span>\n    # \u901a\u8fc7\u540e\u624d\u771f\u7684 subprocess.run(command)<\/span>\n    ...<\/span>\n<\/code><\/pre>\n<\/div>\n
\u5173\u952e\u8bcd\u9ed1\u540d\u5355\u4e0d\u662f\u5b8c\u7f8e\u7684\uff08\u53ef\u4ee5\u88ab\u7ed5\u8fc7\uff09\uff0c\u4f46\u5b83\u662f\u7b2c\u4e00\u9053\u5173<\/strong>\u2014\u2014\u7edd\u5927\u591a\u6570\u5e38\u89c1\u5371\u9669\u547d\u4ee4\u4f1a\u5728\u8fd9\u91cc\u88ab\u62e6\u4e0b\u3002<\/p>\n
\n
\u4e09\u3001\u7b2c\u4e8c\u5c42\uff1a\u8f6f\u62e6\u622a \u2014 \u8c01\u53ef\u4ee5\u8c03\u4ec0\u4e48<\/h2>\n
\u786c\u62e6\u622a\u662f\u51fd\u6570\u5185\u90e8\u7684\u9632\u7ebf\u3002\u4f46\u5728 Agent \u4f53\u7cfb\u91cc\uff0c\u6211\u4eec\u8fd8\u9700\u8981\u51fd\u6570\u5916\u9762<\/strong>\u7684\u9632\u7ebf\u2014\u2014\u51b3\u5b9a”\u5f53\u524d\u8fd9\u4e2a Agent \u5b9e\u4f8b\u80fd\u4e0d\u80fd\u7528 run_terminal”\u3002<\/p>\n
3.1 ToolPolicy\uff1a\u56db\u7ea7\u98ce\u9669\u5206\u7c7b<\/h3>\n
\n
<\/span># tooling.py \u2014 \u53ea\u9760\u5de5\u5177\u540d\u5224\u65ad\u98ce\u9669\u7b49\u7ea7<\/span>\nEXECUTE_TOOLS<\/span> =<\/span> frozenset<\/span>({<\/span>"run_code"<\/span>,<\/span> "run_terminal"<\/span>,<\/span> "demo_code_run"<\/span>})<\/span>\nWRITE_TOOLS<\/span> =<\/span> frozenset<\/span>({<\/span>"file_write"<\/span>})<\/span>\n\nclass<\/span> <\/span>ToolPolicy<\/span>:<\/span>\n    def<\/span> <\/span>classify<\/span>(<\/span>self<\/span>,<\/span> name<\/span>:<\/span> str<\/span>)<\/span> -><\/span> RiskKind<\/span>:<\/span>\n        if<\/span> name<\/span> in<\/span> EXECUTE_TOOLS<\/span>:<\/span>\n            return<\/span> "execute"<\/span>       # \u6267\u884c\u7c7b\uff08subprocess \/ eval\uff09<\/span>\n        if<\/span> name<\/span> in<\/span> WRITE_TOOLS<\/span>:<\/span>\n            return<\/span> "write"<\/span>         # \u5199\u5165\u7c7b\uff08\u6587\u4ef6\u5199\u5165\uff09<\/span>\n        if<\/span> name<\/span>.<\/span>startswith<\/span>(<\/span>"mcp_"<\/span>):<\/span>\n            return<\/span> "mcp"<\/span>           # MCP \u8fdc\u7aef\u5de5\u5177<\/span>\n        return<\/span> "read"<\/span>              # \u9ed8\u8ba4\uff1a\u53ea\u8bfb<\/span>\n\n    allow_write<\/span>:<\/span> bool<\/span> =<\/span> True<\/span>\n    allow_execute<\/span>:<\/span> bool<\/span> =<\/span> False<\/span>    # \u2190 \u9ed8\u8ba4\u7981\u6b62\u6267\u884c\u7c7b\u5de5\u5177<\/span>\n    allow_mcp<\/span>:<\/span> bool<\/span> =<\/span> True<\/span>\n    confirm_write<\/span>:<\/span> bool<\/span> =<\/span> False<\/span>\n    confirm_execute<\/span>:<\/span> bool<\/span> =<\/span> True<\/span>   # \u2190 \u5982\u679c\u5141\u8bb8\uff0c\u6bcf\u6b21\u9700\u8981\u786e\u8ba4<\/span>\n    confirm_mcp<\/span>:<\/span> bool<\/span> =<\/span> True<\/span>\n<\/code><\/pre>\n<\/div>\n
\u56db\u7ea7\u5206\u7c7b + 6 \u4e2a\u5e03\u5c14\u5f00\u5173\uff0c\u4e00\u884c\u914d\u7f6e\u5c31\u80fd\u5207\u6362\u6574\u5957\u5b89\u5168\u7b56\u7565\u3002<\/p>\n
3.2 \u4e0d\u540c surface \u53ef\u4ee5\u6709\u4e0d\u540c\u7b56\u7565<\/h3>\n
\n
<\/span># CLI \u7aef\uff1a\u5141\u8bb8 execute\uff0c\u4f46\u6bcf\u6b21\u9700\u8981\u786e\u8ba4<\/span>\ncli_executor<\/span> =<\/span> ToolExecutor<\/span>(<\/span>\n    tool_map<\/span>,<\/span>\n    policy<\/span>=<\/span>ToolPolicy<\/span>(<\/span>\n        allow_write<\/span>=<\/span>True<\/span>,<\/span>\n        allow_execute<\/span>=<\/span>True<\/span>,<\/span>        # CLI \u7528\u6237\u5728\u81ea\u5df1\u7535\u8111\u4e0a<\/span>\n        confirm_execute<\/span>=<\/span>True<\/span>,<\/span>      # \u4f46\u6bcf\u6b21\u90fd\u5f39\u786e\u8ba4<\/span>\n    ),<\/span>\n    confirm<\/span>=<\/span>lambda<\/span> name<\/span>,<\/span> risk<\/span>,<\/span> args<\/span>:<\/span> input<\/span>(<\/span>f<\/span>"\u26a0\ufe0f \u5373\u5c06\u6267\u884c <\/span>{<\/span>name<\/span>}<\/span>\uff0c\u786e\u8ba4\uff1f[y\/N] "<\/span>)<\/span>.<\/span>lower<\/span>()<\/span> ==<\/span> "y"<\/span>,<\/span>\n)<\/span>\n\n# Web UI \u7aef\uff1a\u5b8c\u5168\u7981\u6b62 execute<\/span>\nweb_executor<\/span> =<\/span> ToolExecutor<\/span>(<\/span>\n    tool_map<\/span>,<\/span>\n    policy<\/span>=<\/span>ToolPolicy<\/span>(<\/span>\n        allow_write<\/span>=<\/span>True<\/span>,<\/span>\n        allow_execute<\/span>=<\/span>False<\/span>,<\/span>       # Web \u7aef\u7981\u6b62<\/span>\n    ),<\/span>\n)<\/span>\n<\/code><\/pre>\n<\/div>\n
\u6ce8\u610f\uff1a\u540c\u4e00\u4e2a tool_map<\/strong>\uff0821 \u4e2a\u5de5\u5177\uff09\uff0c\u4e24\u4e2a surface \u5404\u81ea\u6784\u9020\u4e0d\u540c\u7684 ToolExecutor\u3002CLI \u4e0a run_terminal<\/code> \u53ef\u7528\u4f46\u8981\u786e\u8ba4\uff0cWeb UI \u4e0a\u76f4\u63a5\u88ab\u62d2\u3002<\/p>\n
3.3 \u81ea\u52a8\u6ce8\u5165 allow_unsafe<\/h3>\n
\n
<\/span># tooling.py ToolExecutor.execute() \u5185\u90e8<\/span>\nparams<\/span> =<\/span> inspect<\/span>.<\/span>signature<\/span>(<\/span>func<\/span>)<\/span>.<\/span>parameters<\/span>\nif<\/span> risk<\/span> ==<\/span> "execute"<\/span> and<\/span> "allow_unsafe"<\/span> in<\/span> params<\/span>:<\/span>\n    kwargs<\/span>[<\/span>"allow_unsafe"<\/span>]<\/span> =<\/span> True<\/span>\n<\/code><\/pre>\n<\/div>\n
\u6211\u4eec\u7684 run_terminal<\/code> \/ run_code<\/code> \u6709\u4e00\u4e2a allow_unsafe=False<\/code> \u53c2\u6570\uff0c\u9ed8\u8ba4\u4e0d\u5141\u8bb8\u3002ToolExecutor \u68c0\u6d4b\u5230\u8fd9\u662f execute \u98ce\u9669\u4e14\u51fd\u6570\u6709 allow_unsafe<\/code> \u53c2\u6570\u65f6\uff0c\u81ea\u52a8\u6ce8\u5165 allow_unsafe=True<\/code><\/strong>\u2014\u2014\u4f46\u524d\u63d0\u662f\u8fd9\u4e2a surface \u5141\u8bb8 execute\u3002\u8fd9\u662f\u4e2a\u5c0f\u6280\u5de7\uff1a\u8ba9\u5de5\u5177\u51fd\u6570\u7684\u9ed8\u8ba4\u884c\u4e3a\u662f”\u4e0d\u5b89\u5168”\uff0c\u53ea\u6709\u5b89\u5168\u7b56\u7565\u653e\u884c\u65f6\u624d\u89e3\u9501\u3002<\/p>\n
\n
\u56db\u3001\u7b2c\u4e09\u5c42\uff1a\u8ba9 LLM \u81ea\u5df1\u5224\u65ad \u2014 human_confirm<\/h2>\n
\u524d\u4e24\u5c42\u90fd\u662f\u6211\u4eec\u7684\u4ee3\u7801\u5728\u62e6\u622a<\/strong>\u3002\u4f46\u8fd8\u6709\u4e00\u5c42\u662f\u8ba9 LLM \u4e3b\u52a8\u914d\u5408<\/strong>\u2014\u2014\u6ce8\u518c\u4e00\u4e2a”\u5411\u7528\u6237\u8bf7\u6c42\u786e\u8ba4”\u7684\u5de5\u5177\u3002<\/p>\n
4.1 human_confirm \u662f\u4ec0\u4e48<\/h3>\n
human_confirm<\/code> \u662f\u4e00\u4e2a Function Calling \u5de5\u5177<\/strong>\u2014\u2014\u548c calculator\u3001file_read \u5e76\u5217\u7684\u5de5\u5177\u3002LLM \u53ef\u4ee5\u8c03\u5b83\u3002<\/p>\n
\n
<\/span># app_core.py \u2014 Tool Schema<\/span>\n{<\/span>\n    "type"<\/span>:<\/span> "function"<\/span>,<\/span>\n    "function"<\/span>:<\/span> {<\/span>\n        "name"<\/span>:<\/span> "human_confirm"<\/span>,<\/span>\n        "description"<\/span>:<\/span> "Human-in-the-loop \u4eba\u5de5\u786e\u8ba4\u3002\u6267\u884c\u654f\u611f\/\u7834\u574f\u6027\u64cd\u4f5c\u524d\u6682\u505c\u7b49\u5f85\u7528\u6237\u786e\u8ba4..."<\/span>,<\/span>\n        "parameters"<\/span>:<\/span> {<\/span>\n            "type"<\/span>:<\/span> "object"<\/span>,<\/span>\n            "properties"<\/span>:<\/span> {<\/span>\n                "action"<\/span>:<\/span> {<\/span>\n                    "type"<\/span>:<\/span> "string"<\/span>,<\/span>\n                    "description"<\/span>:<\/span> "\u63cf\u8ff0\u5373\u5c06\u6267\u884c\u7684\u64cd\u4f5c"<\/span>\n                }<\/span>\n            },<\/span>\n            "required"<\/span>:<\/span> [<\/span>"action"<\/span>],<\/span>\n        },<\/span>\n    },<\/span>\n}<\/span>\n<\/code><\/pre>\n<\/div>\n
System Prompt \u91cc\u6709\u6307\u5f15\uff1a<\/p>\n
\n
\u6267\u884c\u654f\u611f\/\u7834\u574f\u6027\u64cd\u4f5c\u524d\uff08\u5220\u9664\u8986\u76d6\u6587\u4ef6\u3001\u5199\u5165\u91cd\u8981\u6570\u636e\u3001SQL DDL\/DML\u3001\u7ec8\u7aef\u5199\u5165\u547d\u4ee4\uff09\uff0c\u5fc5\u987b\u5148\u8c03\u7528<\/strong> human_confirm \u8ba9\u7528\u6237\u786e\u8ba4\u3002<\/p>\n<\/blockquote>\n
4.2 \u89e6\u53d1\u65f6\u673a<\/h3>\n
LLM \u5728”\u60f3\u8c03 run_terminal”\u4e4b\u524d\uff0c\u5148\u60f3”\u6211\u8981\u4e0d\u8981\u5148\u95ee\u4e00\u4e0b\u7528\u6237”\u2014\u2014\u7136\u540e\u8c03 human_confirm(action=\"\u5c06\u6267\u884c rm -rf _temp_dir\/\uff0c\u786e\u8ba4\u6e05\u7406\uff1f\")<\/code>\u3002<\/p>\n
CLI \u7aef\u540c\u6b65\u963b\u585e\u7b49\u7528\u6237\u8f93\u5165\uff1a<\/p>\n
\n
<\/span>def<\/span> <\/span>cli_human_confirm<\/span>(<\/span>action<\/span>:<\/span> str<\/span>)<\/span> -><\/span> str<\/span>:<\/span>\n    resp<\/span> =<\/span> input<\/span>(<\/span>f<\/span>"\ud83e\udd14 <\/span>{<\/span>action<\/span>}<\/span>\\n<\/span>\u8bf7\u8f93\u5165 y\/yes \u786e\u8ba4\uff0c\u5176\u4ed6\u4efb\u610f\u952e\u53d6\u6d88: "<\/span>)<\/span>.<\/span>strip<\/span>()<\/span>.<\/span>lower<\/span>()<\/span>\n    return<\/span> "\u7528\u6237\u5df2\u6279\u51c6"<\/span> if<\/span> resp<\/span> in<\/span> (<\/span>"y"<\/span>,<\/span> "yes"<\/span>)<\/span> else<\/span> "\u7528\u6237\u53d6\u6d88"<\/span>\n<\/code><\/pre>\n<\/div>\n
Web UI \u7aef\u66f4\u590d\u6742\u2014\u2014\u9700\u8981\u7528 Gradio queue + \u4e8b\u4ef6\u56de\u8c03\u5b9e\u73b0\u6682\u505c\u7b49\u5f85\uff1a<\/p>\n
\n
<\/span># Web \u7aef\uff1a\u628a human_confirm \u7684\u6267\u884c\u6743\u4ea4\u7ed9 Gradio \u4e8b\u4ef6\u5faa\u73af<\/span>\ndef<\/span> <\/span>web_human_confirm<\/span>(<\/span>action<\/span>:<\/span> str<\/span>)<\/span> -><\/span> str<\/span>:<\/span>\n    # \u89e6\u53d1\u524d\u7aef\u5f39\u786e\u8ba4\u6846\uff0c\u6682\u505c Agent \u6267\u884c\u6d41<\/span>\n    # \u7528\u6237\u70b9\u51fb\u540e\u7ed3\u679c\u901a\u8fc7 thread-local \u4f20\u56de<\/span>\n    ...<\/span>\n<\/code><\/pre>\n<\/div>\n
4.3 \u4e09\u5c42\u9632\u5fa1\u5982\u4f55\u4e32\u8054<\/h3>\n
\n
<\/span>\u7528\u6237\u8bf4"\u6e05\u7406\u4e00\u4e0b\u4e34\u65f6\u6587\u4ef6"\n        \u2193\nLLM \u60f3\u8c03 run_terminal \u2192 human_confirm(action="\u6267\u884c Remove-Item -Path _temp -Force")\n        \u2193\n\u7b2c\u4e09\u5c42\uff1ahuman_confirm \u5f39\u786e\u8ba4 \u2192 \u7528\u6237\u70b9"\u62d2\u7edd"\n        \u2193\nLLM \u6536\u5230\u7ed3\u679c "\u7528\u6237\u53d6\u6d88" \u2192 \u653e\u5f03\u6267\u884c \u2192 \u56de\u590d"\u597d\u7684\uff0c\u6211\u6ca1\u6267\u884c\u4efb\u4f55\u64cd\u4f5c"\n        \u2193\n\uff08\u5982\u679c\u7528\u6237\u70b9"\u6279\u51c6"\u2192 LLM \u7ee7\u7eed\u8c03 run_terminal\uff09\n        \u2193\n\u7b2c\u4e8c\u5c42\uff1aToolExecutor.classify("run_terminal") \u2192 "execute"\n         confirm_execute=True \u2192 \u518d\u5f39\u4e00\u6b21\u786e\u8ba4\n        \u2193\n\u7b2c\u4e00\u5c42\uff1arun_terminal \u5185\u90e8 \u2192 \u5173\u952e\u8bcd\u9ed1\u540d\u5355\u68c0\u67e5 \u2192 \u901a\u8fc7 \u2192 subprocess.run()\n<\/code><\/pre>\n<\/div>\n
\u4e09\u5c42\u4e32\u8054\u7684\u597d\u5904\u662f\u5373\u4f7f\u67d0\u4e00\u5c42\u6f0f\u4e86\u4e5f\u6709\u515c\u5e95<\/strong>\uff1a
\n– LLM \u5fd8\u4e86\u8c03 human_confirm \u2192 ToolExecutor \u7684 confirm_execute \u515c\u5e95\uff08CLI \u6bcf\u6b21 execute \u90fd\u5f39\uff09
\n– ToolExecutor \u56e0\u4e3a\u914d\u7f6e\u9519\u6f0f\u4e86 \u2192 \u5173\u952e\u8bcd\u9ed1\u540d\u5355\u515c\u5e95\uff08run_terminal \u5185\u90e8\u786c\u62e6\u622a\uff09<\/p>\n
\n
\u4e94\u3001\u5b89\u5168\u7b56\u7565\u7684\u5224\u5b9a\u8868<\/h2>\n
\u770b\u5b8c\u4e09\u5c42\u9632\u5fa1\uff0c\u6211\u7ed9\u4e00\u4e2a\u5b9e\u7528\u7684\u5224\u5b9a\u8868\u2014\u2014\u4f60\u7684 Agent \u81f3\u5c11\u9700\u8981\u54ea\u51e0\u5c42\uff1a<\/p>\n\n\n\n\n\n\n\n\n\n
\u4f60\u7684 Agent \u573a\u666f<\/th>\n\u7b2c\u4e00\u5c42\uff08\u786c\u62e6\u622a\uff09<\/th>\n\u7b2c\u4e8c\u5c42\uff08ToolPolicy\uff09<\/th>\n\u7b2c\u4e09\u5c42\uff08human_confirm\uff09<\/th>\n<\/tr>\n<\/thead>\n
\u672c\u5730 demo\uff0c\u5de5\u5177\u53ea\u8bfb\uff08RAG\u3001\u77e5\u8bc6\u95ee\u7b54\uff09<\/td>\n\u53ef\u9009\uff08\u6ca1\u6709 execute \u5de5\u5177\uff09<\/td>\n\u4e0d\u9700\u8981<\/td>\n\u4e0d\u9700\u8981<\/td>\n<\/tr>\n
\u672c\u5730 demo\uff0c\u6709 execute \u5de5\u5177\uff08run_terminal\uff09<\/td>\n\u5fc5\u987b<\/strong>\uff08AST \/ \u9ed1\u540d\u5355\uff09<\/td>\n\u5fc5\u987b<\/strong>\uff08allow_execute + confirm\uff09<\/td>\n\u53ef\u9009<\/td>\n<\/tr>\n
Web UI\uff08\u7ed9\u522b\u4eba\u7528\uff09<\/td>\n\u5fc5\u987b<\/strong><\/td>\n\u5fc5\u987b<\/strong>\uff08Web \u7aef allow_execute=False\uff09<\/td>\n\u5fc5\u987b<\/strong><\/td>\n<\/tr>\n
\u751f\u4ea7\u73af\u5883\uff08\u591a\u4eba\u5171\u4eab\uff09<\/td>\n\u5fc5\u987b<\/strong><\/td>\n\u5fc5\u987b<\/strong>\uff08\u7ec6\u7c92\u5ea6 allowlist\uff09<\/td>\n\u5fc5\u987b<\/strong><\/td>\n<\/tr>\n
\u6709 MCP \u8fdc\u7aef\u5de5\u5177<\/td>\n\u5fc5\u987b<\/strong><\/td>\n\u5fc5\u987b<\/strong>\uff08mcp_allowlist\uff09<\/td>\n\u5fc5\u987b<\/strong>\uff08\u8fdc\u7aef\u5de5\u5177\u6743\u9650\u4e0d\u53ef\u63a7\uff09<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
\n
\u516d\u3001\u6f14\u8fdb\u65b9\u5411<\/h2>\n\n\n\n\n\n\n\n\n
\u5c40\u9650<\/th>\n\u73b0\u72b6<\/th>\n\u6f14\u8fdb\u65b9\u5411<\/th>\n<\/tr>\n<\/thead>\n
\u5173\u952e\u8bcd\u9ed1\u540d\u5355\u53ef\u7ed5\u8fc7<\/td>\nPowerShell \u6362\u4e2a\u5199\u6cd5\u5c31\u7ed5<\/td>\nPowerShell AST \u89e3\u6790\uff08[Parser]::ParseInput<\/code>\uff09\u771f\u6b63\u7406\u89e3\u547d\u4ee4\u610f\u56fe<\/td>\n<\/tr>\n
ToolExecutor.classify \u9760\u5de5\u5177\u540d<\/td>\n\u81ea\u5199\u7684\u672c\u5730\u5de5\u5177\u5982\u679c\u53eb mcp_backup<\/code> \u4f1a\u88ab\u8bef\u5224\u4e3a MCP<\/td>\n\u8ba9 callable \u52a0 __risk__<\/code> \u5143\u5c5e\u6027\uff0cclassify \u4ece callable \u8bfb\u53d6<\/td>\n<\/tr>\n
human_confirm \u53ea\u6709 approve\/deny<\/td>\n\u7528\u6237\u4e0d\u80fd”\u4fee\u6539\u547d\u4ee4\u540e\u518d\u6279\u51c6”<\/td>\n\u8fd4\u56de\u7ed3\u6784\u5316\u7ed3\u679c\uff08approve \/ deny \/ modify \/ delegate\uff09<\/td>\n<\/tr>\n
ToolPolicy \u5168\u9760\u5e03\u5c14\u5f00\u5173<\/td>\n\u4e0d\u591f\u7075\u6d3b\uff08\u6bd4\u5982”file_write \u53ea\u80fd\u5199 workspace \u76ee\u5f55”\uff09<\/td>\n\u6bcf\u7c7b\u98ce\u9669\u7684 allowlist \u53ef\u4ee5\u662f\u4e00\u4e2a predicate \u51fd\u6570<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
\n
\u5ef6\u4f38\u9605\u8bfb<\/h2>\n